---
id: "CVE-2026-120863"
page: "https://infrastack.ai/live/CVE-2026-120863"
kind: "vulnerability"
aliases: ["CVE-2026-120863"]
title: "Citrix NetScaler ADC and Gateway: management plane memory overflow enables denial of service"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC", "fixed": ["14.1-73.57", "13.1-64.39", "14.1-FIPS 14.1-73.58", "13.1-FIPS/13.1-NDcPP 13.1-37.293"], "affected": "unknown (bulletin lists only fixed builds)", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.57", "13.1-64.39"], "affected": "unknown (bulletin lists only fixed builds)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "infrastructure", "load-balancer", "management-plane", "netscaler", "netscaler-gateway", "self-hosted"]
not_affected_if: ["citrix-managed-cloud", "management-network-isolated"]
published_at: "2026-11-13T08:17:17+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:46:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120863", "first_seen_at": "2026-11-13T08:44:24+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T08:46:09+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305"]}]
exploit_sources: []
---

# Citrix NetScaler ADC and Gateway: management plane memory overflow enables denial of service

Link for people: https://infrastack.ai/live/CVE-2026-120863 (this .md is for agents)

A memory overflow in the management plane of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior or a denial of service. The sources do not say whether code execution or data access is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC affected unknown (bulletin lists only fixed builds) fixed 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, 13.1-FIPS/13.1-NDcPP 13.1-37.293
- vendor:NetScaler Gateway affected unknown (bulletin lists only fixed builds) fixed 14.1-73.57, 13.1-64.39

## How to check

Exposed if an untrusted host can reach the appliance's NSIP or NSIP6 management address. Check the running build (show version) against the fixed builds, and check which networks can reach NSIP. NetScaler Console's Security Advisory dashboard (CVE Detection) can scan for this CVE.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later of 13.1, ADC 14.1-FIPS 14.1-73.58 or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120863
- 2026-11-13T08:46:09+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Read Citrix CTX697305 (Nov 12 2026). Mgmt-plane row matches this CVE's description and sits in id order between 120862 and 120864, but the page text drops that row's CVE id, so the mapping is inferred. Bulletin has no exploitation claim and no workaround; no per-CVE check steps. Affected versions not listed, only fixed builds.

## Documents

- [advisory] Citrix NetScaler ADC and Gateway Security Bulletin CTX697305 https://support.citrix.com/external/article/CTX697305

## From the sources

Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_